<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div><br>On 2 Apr 2017, at 17:15, Simon Janeshvili <<a href="mailto:sikking23@yahoo.com">sikking23@yahoo.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1491145764414_13420">Hey all,</div><div id="yui_3_16_0_ym19_1_1491145764414_13421"><br></div><div id="yui_3_16_0_ym19_1_1491145764414_13422">I am running suricata on ubuntu vm, with an simple lua rule.</div><div id="yui_3_16_0_ym19_1_1491145764414_13423">But I have noticed that not all the packet in the pcap are getting to my rule, e.g. the pcap has 20 packets and only 7 are getting to my rule.</div><div id="yui_3_16_0_ym19_1_1491145764414_13423"><br></div><div id="yui_3_16_0_ym19_1_1491145764414_13423">I would love to know why it's happening.</div></div></div></blockquote><div><br></div><div>We would love too.</div><div>For the purpose - could you please share a reproducible case with rule , the Lua script, a pcap. Also what Suricata version are you using and a step by step procedure to reproduce the issue with the expected and actual result to be.</div><div><br></div><div>Thank you </div><div><br></div><br><blockquote type="cite"><div><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1491145764414_13423"><br></div><div id="yui_3_16_0_ym19_1_1491145764414_13423">Thanks. </div></div></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br></div></blockquote></body></html>